CVE-2026-59206

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...

CVE-2026-59206 n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...

CVE-2026-59206

n8n is affected by a prototype pollution vulnerability in which an authenticated user with the default workflow:create permission could pollute Object.prototype via a crafted workflow saved, updated, or imported through the workflow API. This corruption could cause unauthenticated requests to be ...

CVE-2026-59206 n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...

CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

CVE-2026-15187

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

CVE-2026-15187

The CVE-2026-15187 issue affects the enquirer package (versions up to 2.4.1) and specifically the Enquirer.set function. The root cause is a prototype pollution vulnerability caused by manipulating the argument name (question.name), allowing improper modification of object prototype attributes. I...

Important: Red Hat Security Advisory: Kiali 2.11.14 for Red Hat OpenShift Service Mesh 3.1

Kiali 2.11.14 for Red Hat OpenShift Service Mesh 3.1 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Kiali 2.22.7 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.7 for Red Hat OpenShift Service Mesh 3.3 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: Red Hat Security Advisory: Kiali 2.4.20 for Red Hat OpenShift Service Mesh 3.0

Kiali 2.4.20 for Red Hat OpenShift Service Mesh 3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

JetBrains YouTrack < 2026.2.16593 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.16593. It is, therefore, affected by multiple vulnerabilities, including: - The websandbox bridge was vulnerable to a prototype pollution attack. CVE-2026-57926 - Improper access control allowed reading users' priva...

PT-2026-56815

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.61 n8n versions prior to 2.27.4 n8n versions prior to 2.28.1 Description An authenticated user with workflow:create permissions can perform prototype pollution by saving, updating, or importing a specially crafted...

TencentOS Server 4: grafana (TSSA-2026:0525)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0525 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

PT-2026-56812

Name of the Vulnerable Software and Affected Versions enquirer versions prior to 2.4.2 Description A flaw in the Public Package API component allows remote attackers to perform prototype pollution. By manipulating the question.name argument within the Enquirer.set function, an attacker can cause...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +176 more potentially affected by CVE-2026-55575 via liquidjs (>=10.2.0, <=10.27.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.4.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =0.31.16 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-55575 Source advisory:...

@aoagents/ao (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc), @aoagents/ao-cli (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc) +84 more potentially affected by CVE-2026-59807 via @composio/core (>=0.1.0-rc.3, <=0.13.1)

@composio/core NPM version =0.1.0-rc.3, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.0.2, =1.0.0, =0.1.0-rc.3, =4.4.0, =3.8.11, =3.8.11, =3.7.18, =3.7.18, =3.7.18,...

shadcn-ui-lib (>=0.0.9, <=0.0.18) potentially affected by CVE-2026-55596 via @platejs/media (53.0.0)

@platejs/media NPM version 53.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/media and may be impacted: - shadcn-ui-lib =0.0.9, =0.0.18 Source cves: CVE-2026-55596 Source advisory: SNYK:JS-PLATEJSMEDIA-17901642...

@appium/base-plugin (>=3.2.0, <=3.3.0), @appium/fake-plugin (>=4.2.0, <=4.3.0) +9 more potentially affected by CVE-2026-58191 via @appium/base-driver (>=10.3.0, <=10.6.0)

@appium/base-driver NPM version =10.3.0, =3.2.0, =4.2.0, =1.0.0, =3.0.10, =2.107.37, =2.107.37, =3.3.0, =0.1.0-beta.1, =0.79.0, =1.0.96, =1.0.115 Source cves: CVE-2026-58191 Source advisory: SNYK:JS-APPIUMBASEDRIVER-17900619...

@adobe/helix-docx2md (1.9.29), @adobe/helix-importer (>=3.4.141, <=3.4.143) +33 more potentially affected by CVE-2026-59868 +1 more via js-yaml (>=5.0.0, <=5.1.0)

js-yaml NPM version =5.0.0, =3.4.141, =2.2.62, =1.0.8, =0.2.12, =0.2.12, =0.2.12, =0.2.13, =0.2.12, =0.2.16, =0.2.14, =0.2.12, =0.2.17 and more Source cves: CVE-2026-59868, CVE-2026-59869 Source advisory: SNYK:JS-JSYAML-17900092...